11357 matches found
ECHO-9CCD-D5CE-B1A9
Bulletin has no description...
ECHO-54BC-B2EC-53E9 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-778A-550A-1FD5 Type confusion in xmlParseReference (ctxt vs ctxt->userData in SAX callbacks). Introduced by commit e1153832 ("parser: Fix quadratic behavior when copying entities", 2024-01-07), first released in v2.13.0. Last unaffected release: v2.12.10. Debian trixie package is 2.12.7+dfsg+really2.9.14 (effectively v2.9.14) which predates the bug — all SAX callbacks in xmlParseReference already correctly pass ctxt->userData. Verified against the actual Debian source from salsa.debian.org. Not exploitable.
Bulletin has no description...
ECHO-0EFA-566E-D6F7
Bulletin has no description...
ECHO-18A6-78F5-CC48
Bulletin has no description...
ECHO-A8E4-9962-CA51 Windows-only. The information disclosure is Windows automatically opening an SMB connection and sending the user's NTLM credentials when a document references file://<host>/<share> (e.g. xlink:href in an .odt). On Linux, LibreOffice does not reach SMB for such URLs and there is no automatic NTLM authentication, so nothing is disclosed. Upstream additionally restricted such accesses to trusted locations. Debian marks this issue unimportant ("generic behaviour of accessing remote SMB shares"). https://security-tracker.debian.org/tracker/CVE-2018-10583
Bulletin has no description...
ECHO-01AC-8821-274A
Bulletin has no description...
ECHO-3DD8-08D4-1C16
Bulletin has no description...
ECHO-DDB8-C818-EDCA Vulnerable code is not present in libraw 0.21.4 (the version shipped in Debian trixie). The CVE describes a heap out-of-bounds write in HuffTable::initval (src/decompressors/losslessjpeg.cpp), reachable via LibRaw::sony_ycbcr_load_raw -> LibRaw_LjpegDecompressor::initialize -> HuffTable::initval. None of those symbols exist in 0.21.4: the src/decompressors/ directory, the LibRaw_LjpegDecompressor class, and the sony_ycbcr_load_raw entry point were all introduced together in libraw 0.22.0. Empirically confirmed by running the public PoC from https://github.com/biniamf/pocs/tree/main/libraw_lljpeg against an ASan build of unpatched libraw 0.21.4: the file is rejected at open with "Unsupported file format or not RAW file"; the same PoC reproduces the heap-buffer-overflow in 0.22.0 with the stack trace from the Talos report.
Bulletin has no description...
ECHO-F535-0049-4D66
Bulletin has no description...
ECHO-301D-890F-D77C Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-0051-E755-E08E
Bulletin has no description...
ECHO-913B-6868-0495
Bulletin has no description...
ECHO-BAA9-B0DD-7FD5
Bulletin has no description...
ECHO-4DDC-212A-1B8D Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-58DA-C48D-AC57 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-74F8-0C0F-635F
Bulletin has no description...
ECHO-93CE-7F96-B607 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-E10D-8878-8638 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-9070-2F4F-EBC3 The CVE is disputed by upstream. It's part of 3 similar cve's, which are disputed by this article: https://github.com/kastel-security/Journald/blob/main/journald-publication.pdf The guy who wrote the article also provides patches, 2 of them are in upstream, 3rd one only on his site. One of the patches does not completely solve it's cve (CVE-2023-31438). We should consider this not applicable in the meantime and come back to it later. https://security-tracker.debian.org/tracker/CVE-2023-31438 https://nvd.nist.gov/vuln/detail/CVE-2023-31438 https://github.com/systemd/systemd/pull/28886
Bulletin has no description...
ECHO-6A98-F3C7-3544 Kernel vulnerabilities are irrelevant in container environments. Additionally this package only contains header files.
Bulletin has no description...
ECHO-92BD-FC28-530B
Bulletin has no description...
ECHO-CAFE-871F-3A76 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-C0ED-95B4-F8E1 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-548B-80CE-E027 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-29D7-C7C3-A6CC
Bulletin has no description...
ECHO-D777-8AFD-DE52
Bulletin has no description...
ECHO-28BA-D9BF-3B84
Bulletin has no description...
ECHO-AE04-330C-E6A6
Bulletin has no description...
ECHO-8EFC-30C9-2EDD Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-3E3E-0BD6-28A8 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-73FB-9415-45A1 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-CD33-EC70-D5F2
Bulletin has no description...
ECHO-9EB7-A106-97D7
Bulletin has no description...
ECHO-4B5C-1C2D-3960 Kernel vulnerabilities are irrelevant in container environments.
Bulletin has no description...
ECHO-78D7-B482-DB11 Kernel vulnerabilities are irrelevant in container environments. Additionally this package only contains header files.
Bulletin has no description...
ECHO-14B2-C792-E3A0
Bulletin has no description...
ECHO-961B-7868-8727
Bulletin has no description...
ECHO-EB17-7AC4-74C0
Bulletin has no description...
ECHO-3723-3238-2A4C
Bulletin has no description...
ECHO-0EE3-2D8E-995D The maintainer argues this CVE is only relevant when the package is improperly used, which is encrypting messages solely with the elGamal algorithm. https://security-tracker.debian.org/tracker/CVE-2018-6829
Bulletin has no description...
ECHO-53E1-A53D-D5B1
Bulletin has no description...
ECHO-A639-96C1-EE8F
Bulletin has no description...
ECHO-0707-183D-ABEA
Bulletin has no description...
ECHO-F3E4-112C-36EA
Bulletin has no description...
ECHO-80DA-5A07-B637 Kernel vulnerabilities are irrelevant in container environments. Additionally this package only contains header files.
Bulletin has no description...
ECHO-4636-2815-6EB2
Bulletin has no description...
ECHO-EAB7-3E17-B4F3 The cve is that when modifying a jpeg image with imagemagic, the original image thumbnail might not modify the EXIF thumbnail. But there are ways to remove the EXIF profile with like with a convert --strip command. It's just something an application needs to handle. The debian bug was closed and the upstream said it won't fix it.
Bulletin has no description...